57_Wolve
7faa9098de
Restructure around a single entry point (automations.sh) with a Gum wizard and a self-extracting bundle for repo-less installs. Add scripts/oslib.sh so the provisioning scripts (setup-host, harden-ssh, harden-jumphost, sshuser) run on Alpine/Debian/Alma; seed root keys from globals/. - ntfy SSH-login alerts (user, source IP, key, region, jump target) via pam_exec - daily auto-updates with AUTO_REBOOT=idle (reboots only when no SSH active) and opt-in Alpine stable-branch upgrades - generic + per-deployment cloud-init; Gitea release workflow on tag - README/LICENSE/.gitignore/.gitattributes (force LF); repo URLs -> Gitea
82 lines
2.3 KiB
Caddyfile
82 lines
2.3 KiB
Caddyfile
# Caddyfile for pocket-id stack.
|
|
#
|
|
# Two site blocks:
|
|
# $POCKETID_DOMAIN pocket-id (via anubis PoW gate)
|
|
# $BASE_DOMAIN /.well-known/webfinger for OIDC discovery; everything
|
|
# else redirects to $REDIRECT_URL
|
|
{
|
|
email {$ACME_EMAIL}
|
|
# Uncomment for staging certs while testing (avoids LE rate limits):
|
|
# acme_ca https://acme-staging-v02.api.letsencrypt.org/directory
|
|
}
|
|
|
|
# ----------------------------------------------------------------------------
|
|
# Auth: pocket-id behind anubis
|
|
# ----------------------------------------------------------------------------
|
|
{$POCKETID_DOMAIN} {
|
|
encode zstd gzip
|
|
|
|
reverse_proxy anubis-pid:8923 {
|
|
header_up X-Real-IP {remote_host}
|
|
header_up X-Forwarded-For {remote_host}
|
|
header_up X-Forwarded-Proto {scheme}
|
|
header_up X-Forwarded-Host {host}
|
|
}
|
|
|
|
header {
|
|
Strict-Transport-Security "max-age=31536000; includeSubDomains"
|
|
X-Content-Type-Options "nosniff"
|
|
X-Frame-Options "DENY"
|
|
Referrer-Policy "strict-origin-when-cross-origin"
|
|
Permissions-Policy "interest-cohort=()"
|
|
-Server
|
|
}
|
|
|
|
log {
|
|
output stdout
|
|
format console
|
|
}
|
|
}
|
|
|
|
# ----------------------------------------------------------------------------
|
|
# Base domain: WebFinger for OIDC discovery + redirect everything else.
|
|
# Required for Tailscale's custom-OIDC setup -- the email's domain must
|
|
# serve /.well-known/webfinger pointing at the issuer.
|
|
# ----------------------------------------------------------------------------
|
|
{$BASE_DOMAIN} {
|
|
encode zstd gzip
|
|
|
|
@webfinger path /.well-known/webfinger
|
|
handle @webfinger {
|
|
header Content-Type "application/jrd+json"
|
|
header Cache-Control "public, max-age=3600"
|
|
templates
|
|
respond `{
|
|
"subject": "{{.Req.URL.Query.Get "resource"}}",
|
|
"links": [
|
|
{
|
|
"rel": "http://openid.net/specs/connect/1.0/issuer",
|
|
"href": "https://{$POCKETID_DOMAIN}"
|
|
}
|
|
]
|
|
}` 200
|
|
}
|
|
|
|
handle {
|
|
redir {$REDIRECT_URL}{uri} permanent
|
|
}
|
|
|
|
header {
|
|
Strict-Transport-Security "max-age=31536000; includeSubDomains"
|
|
X-Content-Type-Options "nosniff"
|
|
Referrer-Policy "strict-origin-when-cross-origin"
|
|
-Server
|
|
}
|
|
|
|
log {
|
|
output stdout
|
|
format console
|
|
}
|
|
}
|